apache · applike-ss · Jul 29, 2026
diff --git a/docs/content.zh/docs/deployment/helm/cert-manager.md b/docs/content.zh/docs/deployment/helm/cert-manager.md
@@ -40,7 +40,7 @@ The commands on this page always install and remove the newest cert-manager rele
 
 ## Webhook Certificate
 
-With the webhooks enabled, the chart creates two cert-manager resources alongside the operator: a self-signed `Issuer` and a `Certificate` covering the webhook service names, issued into the `webhook-server-cert` secret that the operator deployment mounts. The certificate also carries a PKCS12 keystore for the webhook's Java runtime, protected by the default webhook password secret or by a custom one set through `webhook.keystore.passwordSecretRef`. For FIPS-compliant environments, the keystore encryption profile is selected with `webhook.keystore.pkcs12Profile`, listed with the other parameters on the Helm [Installation]({{< ref "docs/deployment/helm/installation" >}}) page.
+With the webhooks enabled, the chart creates two cert-manager resources alongside the operator: a self-signed `Issuer` and a `Certificate` covering the webhook service names, issued into the `flink-operator-webhook-server-cert` secret that the operator deployment mounts. The certificate also carries a PKCS12 keystore for the webhook's Java runtime, protected by the default webhook password secret or by a custom one set through `webhook.keystore.passwordSecretRef`. For FIPS-compliant environments, the keystore encryption profile is selected with `webhook.keystore.pkcs12Profile`, listed with the other parameters on the Helm [Installation]({{< ref "docs/deployment/helm/installation" >}}) page.
 
 Cert-manager also closes the trust chain from the other side: its CA injector patches the certificate's CA bundle into the Mutating and Validating webhook configurations, through the `cert-manager.io/inject-ca-from` annotation, so the Kubernetes API server trusts the webhook it calls.
 

diff --git a/docs/content.zh/docs/deployment/overview.md b/docs/content.zh/docs/deployment/overview.md
@@ -38,7 +38,7 @@ Everything the operator needs lands in the cluster at installation time. Helm in
 
 The figure reads in the order things come into existence:
 - At cluster scope sit the four CRDs of the `flink.apache.org` API group, registered by Helm.
-- The operator namespace holds the operator's own footprint: a single Deployment whose pod runs the operator and webhook containers, the [configuration ConfigMap]({{< ref "docs/deployment/configuration" >}}) they read, and the webhook's Service with its two TLS Secrets, `webhook-server-cert` carrying the certificate and `flink-operator-webhook-secret` the password of its keystore.
+- The operator namespace holds the operator's own footprint: a single Deployment whose pod runs the operator and webhook containers, the [configuration ConfigMap]({{< ref "docs/deployment/configuration" >}}) they read, and the webhook's Service with its two TLS Secrets, `flink-operator-webhook-server-cert` carrying the certificate and `flink-operator-webhook-secret` the password of its keystore.
 - The managed namespace holds the `FlinkDeployment` itself and everything materialized from it: the JobManager Deployment with its ReplicaSet and pods, the bare TaskManager pods, the REST Service, and the ConfigMaps that carry the Flink configuration, the pod template, the HA metadata, and the [autoscaler state]({{< ref "docs/operations/state#autoscaler-state" >}}).
 - The entry points frame the picture: `kubectl` or Helm reaches everything through the Kubernetes API server, while a browser reaches the Flink Web UI through the optional Ingress in front of the REST Service.
 

diff --git a/docs/content.zh/docs/internals/startup.md b/docs/content.zh/docs/internals/startup.md
@@ -84,7 +84,7 @@ helm install -f custom-values.yaml  flink-kubernetes-operator  helm/flink-kubern
    ║          │                                                                   │       ║
    ║          ├──► cert-manager/* ─► Issuer + Certificate                         │       ║
    ║          │     (optional)       (cert-manager generates the                  │       ║
-   ║          │                      webhook-server-cert Secret)                  │       ║
+   ║          │                      flink-operator-webhook-server-cert Secret)   │       ║
    ║          │                                                                   │       ║
    ║          └──────────► controller/deployment.yaml ◄───────────────────────────┘       ║
    ╚══════════════════════════════════════════════════════════════════════════════════════╝

diff --git a/docs/content.zh/docs/internals/webhook.md b/docs/content.zh/docs/internals/webhook.md
@@ -40,7 +40,7 @@ Because admission decisions can depend on other resources, the webhook maintains
 
 The server reads its keystore from `WEBHOOK_KEYSTORE_FILE`, `WEBHOOK_KEYSTORE_TYPE`, and `WEBHOOK_KEYSTORE_PASSWORD`. Without a configured keystore the webhook runs plain HTTP, useful only for local development. The API server requires TLS for admission webhooks.
 
-In the chart, cert-manager issues the certificate: an Issuer and a Certificate produce the `webhook-server-cert` Secret carrying a PKCS12 keystore, mounted into the webhook container, with the keystore password sourced from the generated webhook Secret or a user-provided `passwordSecretRef`. FIPS-compliant environments can force the `Modern2023` encryption profile through `webhook.keystore.pkcs12Profile`. The CA bundle is injected into both admission configurations through the `cert-manager.io/inject-ca-from` annotation.
+In the chart, cert-manager issues the certificate: an Issuer and a Certificate produce the `flink-operator-webhook-server-cert` Secret carrying a PKCS12 keystore, mounted into the webhook container, with the keystore password sourced from the generated webhook Secret or a user-provided `passwordSecretRef`. FIPS-compliant environments can force the `Modern2023` encryption profile through `webhook.keystore.pkcs12Profile`. The CA bundle is injected into both admission configurations through the `cert-manager.io/inject-ca-from` annotation.
 
 Certificate rotation needs no restart: the SSL context is a `ReloadableSslContext`, and a `FileSystemWatchService` watching the keystore directory reloads it whenever cert-manager renews the Secret.
 

diff --git a/docs/content/docs/deployment/helm/cert-manager.md b/docs/content/docs/deployment/helm/cert-manager.md
@@ -40,7 +40,7 @@ The commands on this page always install and remove the newest cert-manager rele
 
 ## Webhook Certificate
 
-With the webhooks enabled, the chart creates two cert-manager resources alongside the operator: a self-signed `Issuer` and a `Certificate` covering the webhook service names, issued into the `webhook-server-cert` secret that the operator deployment mounts. The certificate also carries a PKCS12 keystore for the webhook's Java runtime, protected by the default webhook password secret or by a custom one set through `webhook.keystore.passwordSecretRef`. For FIPS-compliant environments, the keystore encryption profile is selected with `webhook.keystore.pkcs12Profile`, listed with the other parameters on the Helm [Installation]({{< ref "docs/deployment/helm/installation" >}}) page.
+With the webhooks enabled, the chart creates two cert-manager resources alongside the operator: a self-signed `Issuer` and a `Certificate` covering the webhook service names, issued into the `flink-operator-webhook-server-cert` secret that the operator deployment mounts. The certificate also carries a PKCS12 keystore for the webhook's Java runtime, protected by the default webhook password secret or by a custom one set through `webhook.keystore.passwordSecretRef`. For FIPS-compliant environments, the keystore encryption profile is selected with `webhook.keystore.pkcs12Profile`, listed with the other parameters on the Helm [Installation]({{< ref "docs/deployment/helm/installation" >}}) page.
 
 Cert-manager also closes the trust chain from the other side: its CA injector patches the certificate's CA bundle into the Mutating and Validating webhook configurations, through the `cert-manager.io/inject-ca-from` annotation, so the Kubernetes API server trusts the webhook it calls.
 

diff --git a/docs/content/docs/deployment/overview.md b/docs/content/docs/deployment/overview.md
@@ -38,7 +38,7 @@ Everything the operator needs lands in the cluster at installation time. Helm in
 
 The figure reads in the order things come into existence:
 - At cluster scope sit the four CRDs of the `flink.apache.org` API group, registered by Helm.
-- The operator namespace holds the operator's own footprint: a single Deployment whose pod runs the operator and webhook containers, the [configuration ConfigMap]({{< ref "docs/deployment/configuration" >}}) they read, and the webhook's Service with its two TLS Secrets, `webhook-server-cert` carrying the certificate and `flink-operator-webhook-secret` the password of its keystore.
+- The operator namespace holds the operator's own footprint: a single Deployment whose pod runs the operator and webhook containers, the [configuration ConfigMap]({{< ref "docs/deployment/configuration" >}}) they read, and the webhook's Service with its two TLS Secrets, `flink-operator-webhook-server-cert` carrying the certificate and `flink-operator-webhook-secret` the password of its keystore.
 - The managed namespace holds the `FlinkDeployment` itself and everything materialized from it: the JobManager Deployment with its ReplicaSet and pods, the bare TaskManager pods, the REST Service, and the ConfigMaps that carry the Flink configuration, the pod template, the HA metadata, and the [autoscaler state]({{< ref "docs/operations/state#autoscaler-state" >}}).
 - The entry points frame the picture: `kubectl` or Helm reaches everything through the Kubernetes API server, while a browser reaches the Flink Web UI through the optional Ingress in front of the REST Service.
 

diff --git a/docs/content/docs/internals/startup.md b/docs/content/docs/internals/startup.md
@@ -84,7 +84,7 @@ helm install -f custom-values.yaml  flink-kubernetes-operator  helm/flink-kubern
    ║          │                                                                   │       ║
    ║          ├──► cert-manager/* ─► Issuer + Certificate                         │       ║
    ║          │     (optional)       (cert-manager generates the                  │       ║
-   ║          │                      webhook-server-cert Secret)                  │       ║
+   ║          │                      flink-operator-webhook-server-cert Secret)   │       ║
    ║          │                                                                   │       ║
    ║          └──────────► controller/deployment.yaml ◄───────────────────────────┘       ║
    ╚══════════════════════════════════════════════════════════════════════════════════════╝

diff --git a/docs/content/docs/internals/webhook.md b/docs/content/docs/internals/webhook.md
@@ -40,7 +40,7 @@ Because admission decisions can depend on other resources, the webhook maintains
 
 The server reads its keystore from `WEBHOOK_KEYSTORE_FILE`, `WEBHOOK_KEYSTORE_TYPE`, and `WEBHOOK_KEYSTORE_PASSWORD`. Without a configured keystore the webhook runs plain HTTP, useful only for local development. The API server requires TLS for admission webhooks.
 
-In the chart, cert-manager issues the certificate: an Issuer and a Certificate produce the `webhook-server-cert` Secret carrying a PKCS12 keystore, mounted into the webhook container, with the keystore password sourced from the generated webhook Secret or a user-provided `passwordSecretRef`. FIPS-compliant environments can force the `Modern2023` encryption profile through `webhook.keystore.pkcs12Profile`. The CA bundle is injected into both admission configurations through the `cert-manager.io/inject-ca-from` annotation.
+In the chart, cert-manager issues the certificate: an Issuer and a Certificate produce the `flink-operator-webhook-server-cert` Secret carrying a PKCS12 keystore, mounted into the webhook container, with the keystore password sourced from the generated webhook Secret or a user-provided `passwordSecretRef`. FIPS-compliant environments can force the `Modern2023` encryption profile through `webhook.keystore.pkcs12Profile`. The CA bundle is injected into both admission configurations through the `cert-manager.io/inject-ca-from` annotation.
 
 Certificate rotation needs no restart: the SSL context is a `ReloadableSslContext`, and a `FileSystemWatchService` watching the keystore directory reloads it whenever cert-manager renews the Secret.
 

diff --git a/docs/static/img/deployment/deployment-overview.svg b/docs/static/img/deployment/deployment-overview.svg
diff --git a/helm/flink-kubernetes-operator/templates/cert-manager/certificate.yaml b/helm/flink-kubernetes-operator/templates/cert-manager/certificate.yaml
@@ -45,5 +45,5 @@ spec:
     kind: Issuer
     name: flink-operator-selfsigned-issuer
   commonName: FlinkDeployment Validator
-  secretName: webhook-server-cert
+  secretName: flink-operator-webhook-server-cert
 {{- end }}
diff --git a/helm/flink-kubernetes-operator/templates/controller/deployment.yaml b/helm/flink-kubernetes-operator/templates/controller/deployment.yaml
@@ -271,7 +271,7 @@ spec:
         {{- if eq (include "flink-operator.webhook-enabled" .) "true" }}
         - name: keystore
           secret:
-            secretName: webhook-server-cert
+            secretName: flink-operator-webhook-server-cert
             items:
             - key: keystore.p12
               path: keystore.p12

diff --git a/helm/flink-kubernetes-operator/tests/cert-manager/certificate_test.yaml b/helm/flink-kubernetes-operator/tests/cert-manager/certificate_test.yaml
@@ -33,6 +33,12 @@ tests:
       kind: Certificate
       name: flink-operator-serving-cert
 
+- it: Should use static webhook certificate secret name
+  asserts:
+  - equal:
+      path: spec.secretName
+      value: flink-operator-webhook-server-cert
+
 - it: Should use self signed issuer
   asserts:
   - equal:

diff --git a/helm/flink-kubernetes-operator/tests/controller/deployment_test.yaml b/helm/flink-kubernetes-operator/tests/controller/deployment_test.yaml
@@ -34,6 +34,18 @@ tests:
       name: flink-kubernetes-operator
       namespace: flink-operator
 
+- it: Should mount the static webhook certificate secret
+  asserts:
+  - contains:
+      path: spec.template.spec.volumes
+      content:
+        name: keystore
+        secret:
+          items:
+          - key: keystore.p12
+            path: keystore.p12
+          secretName: flink-operator-webhook-server-cert
+
 - it: Should use the specified image if `image.repository` and `image.tag` are set
   set:
     image: